

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/favicon.png">
  <link rel="icon" href="/img/favicon.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="Fly542">
  <meta name="keywords" content="">
  
    <meta name="description" content="要用tcpdump 抓包，一定要切换到root账户，只有root才有权限将网卡变更为混杂模式。 tcpdump可以分为三大部分内容，第一是选项，第二是过滤表达式，第三是输出信息 基本格式为 tcpdump 选项 &#39;过滤表达式&#39; 实用选项参数说明   参数名 说明    -i 即interface，指定要监听的网卡名,默认为eth0，内核版本&gt;2.2时可用any指定所有网卡">
<meta property="og:type" content="article">
<meta property="og:title" content="tcpdump实用方法总结">
<meta property="og:url" content="http://fly542.cn/2022/11/10/04DevOps/21tcpdump%E5%AE%9E%E7%94%A8%E6%96%B9%E6%B3%95%E6%80%BB%E7%BB%93/index.html">
<meta property="og:site_name" content="Fly542 技术沉淀">
<meta property="og:description" content="要用tcpdump 抓包，一定要切换到root账户，只有root才有权限将网卡变更为混杂模式。 tcpdump可以分为三大部分内容，第一是选项，第二是过滤表达式，第三是输出信息 基本格式为 tcpdump 选项 &#39;过滤表达式&#39; 实用选项参数说明   参数名 说明    -i 即interface，指定要监听的网卡名,默认为eth0，内核版本&gt;2.2时可用any指定所有网卡">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://fly542.cn/2022/11/10/04DevOps/21tcpdump%E5%AE%9E%E7%94%A8%E6%96%B9%E6%B3%95%E6%80%BB%E7%BB%93/err_01.png">
<meta property="article:published_time" content="2022-11-10T02:40:20.000Z">
<meta property="article:modified_time" content="2024-10-17T09:41:45.033Z">
<meta property="article:author" content="Fly542">
<meta property="article:tag" content="linux">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="http://fly542.cn/2022/11/10/04DevOps/21tcpdump%E5%AE%9E%E7%94%A8%E6%96%B9%E6%B3%95%E6%80%BB%E7%BB%93/err_01.png">
  
  
  <title>tcpdump实用方法总结 - Fly542 技术沉淀</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hint.css@2/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/github-gist.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"fly542.cn","root":"/","version":"1.8.14","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":false,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":null,"app_key":null,"server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 6.0.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>Fly542 技术沉淀</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" parallax=true
         style="background: url('/img/default.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="tcpdump实用方法总结">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2022-11-10 10:40" pubdate>
        2022年11月10日 上午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      3.4k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      29 分钟
    </span>
  

  
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">tcpdump实用方法总结</h1>
            
            <div class="markdown-body">
              <p>要用tcpdump 抓包，一定要切换到<code>root</code>账户，只有<code>root</code>才有权限将网卡变更为<code>混杂模式</code>。</p>
<p>tcpdump可以分为三大部分内容，第一是<code>选项</code>，第二是<code>过滤表达式</code>，第三是<code>输出信息</code></p>
<p>基本格式为 <code>tcpdump 选项 &#39;过滤表达式&#39;</code></p>
<h1 id="实用选项参数说明"><a href="#实用选项参数说明" class="headerlink" title="实用选项参数说明"></a>实用选项参数说明</h1><table>
<thead>
<tr>
<th>参数名</th>
<th>说明</th>
</tr>
</thead>
<tbody><tr>
<td>-i</td>
<td>即interface，指定要监听的网卡名,默认为eth0，内核版本&gt;2.2时可用<code>any</code>指定所有网卡</td>
</tr>
<tr>
<td>-w</td>
<td>指定dump出的内容(原始网络包)存储的文件</td>
</tr>
<tr>
<td>-nn</td>
<td>tcpdump遇到协议号或端口号时，不要将这些号码转换成对应的协议名称或端口名称。如，众所周知21端口是FTP端口，我们希望显示21，而非tcpdump自作聪明的将它显示成FTP</td>
</tr>
<tr>
<td>-X</td>
<td>需要把协议头和包内容都原原本本的显示出来（tcpdump会以16进制和ASCII的形式显示），这在进行协议分析时是绝对的利器。</td>
</tr>
<tr>
<td>-c</td>
<td>设置要抓的包的个数</td>
</tr>
<tr>
<td>-e</td>
<td>增加以太网帧头部信息输出</td>
</tr>
<tr>
<td>-l</td>
<td>使得输出变为行缓冲，只要发现行符号就输出，否则只能等缓冲区满才输出</td>
</tr>
<tr>
<td>-t</td>
<td>输出时不打印时间戳</td>
</tr>
<tr>
<td>-v</td>
<td>输出更详细的信息，增加tos值、ttl值、ID值、总长度、校验值等</td>
</tr>
<tr>
<td>-F</td>
<td>指定过滤表达式所在的文件</td>
</tr>
<tr>
<td>-r</td>
<td>读取-w生成的原始网络包文件</td>
</tr>
<tr>
<td>-B</td>
<td>缓冲区空间大小,单位KB, 出现<code>packets dropped by kernel</code> 时修改此参数</td>
</tr>
</tbody></table>
<h1 id="表达式说明"><a href="#表达式说明" class="headerlink" title="表达式说明"></a>表达式说明</h1><p>tcpdump 的表达式是 <code>pcap-filter</code> 的过滤表达式，可通过 <code>man 7 pcap-filter</code> 查看细节</p>
<p>过滤器表达式由一个或多个<code>原语</code>组成。<code>原语</code>通常是由前面有一个或多个<code>限定词</code>的 <code>id(名称或数字)</code>组成。<br><code>限定词</code>有以下三种不同的类型：</p>
<table>
<thead>
<tr>
<th>类型</th>
<th>说明</th>
<th>常用类型</th>
<th>默认值</th>
<th>示例</th>
</tr>
</thead>
<tbody><tr>
<td>type</td>
<td>type限定词说明<code>id(名称或数字)</code>的类型</td>
<td>host, net , port , portrange</td>
<td>host</td>
<td>‘host foo’<br>‘net 128.3’<br>‘port 20’<br>‘portrange 6000-6008’</td>
</tr>
<tr>
<td>dir</td>
<td>dir 限定词指定id 特定传输方向</td>
<td>src, dst, src or dst, src and dst,<br /> ra, ta,  addr1,  addr2, addr3,  and  addr4.</td>
<td>src or dst</td>
<td>‘src foo’<br /> ‘dst net 128.3’,<br />‘src or dst port ftp-data’</td>
</tr>
<tr>
<td>proto</td>
<td>proto 限定词将匹配限制为特定协议</td>
<td>ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, tcp and udp.</td>
<td>和type一致的所有可用协议<br />‘src foo’ means ‘(ip or arp or rarp) src foo’<br />‘port 53’ means ‘(tcp or udp) port 53’<br />‘net bar’ means ‘(ip or arp or rarp) net bar’</td>
<td>‘ether src foo’<br /> ‘arp net 128.3’<br /> ‘tcp port 21’<br /> ‘udp portrange 7000-7009’<br /> ‘wlan addr2 0:2:3:4:5:6’</td>
</tr>
</tbody></table>
<figure class="highlight apache"><table><tr><td class="gutter"><div class="code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></div></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">host</span>：指定主机名或IP地址，例如’host roclinux.cn’或’host <span class="hljs-number">202.112.18.34</span>′<br><span class="hljs-attribute">net</span> ：指定网络段，例如’arp net <span class="hljs-number">128</span>.<span class="hljs-number">3</span>′或’dst net <span class="hljs-number">128</span>.<span class="hljs-number">3</span>′<br><span class="hljs-attribute">portrange</span>：指定端口区域，例如’src or dst portrange <span class="hljs-number">6000</span>-<span class="hljs-number">6008</span>′<br><br><span class="hljs-attribute">ether</span> fddi tr wlan ppp slip link 均为 链路层协议<br></code></pre></td></tr></table></figure>

<h1 id="示例"><a href="#示例" class="headerlink" title="示例"></a>示例</h1><h2 id="抓包"><a href="#抓包" class="headerlink" title="抓包"></a>抓包</h2><h3 id="抓特定来源的包"><a href="#抓特定来源的包" class="headerlink" title="抓特定来源的包"></a>抓特定来源的包</h3><figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-comment"># 只抓发向10.101.101.101且端口号为53的包，并将抓到的包写入到bind.cap文件中</span><br> <span class="hljs-attribute">tcpdump</span> &#x27;dst <span class="hljs-number">10.101.101.101</span> and port <span class="hljs-number">53</span>&#x27; -w bind.cap<br></code></pre></td></tr></table></figure>
<h3 id="抓取192-168-1-123收到和发送的所有的icmp的包"><a href="#抓取192-168-1-123收到和发送的所有的icmp的包" class="headerlink" title="抓取192.168.1.123收到和发送的所有的icmp的包"></a>抓取192.168.1.123收到和发送的所有的icmp的包</h3><figure class="highlight awk"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs awk">tcpdump -i eth1 <span class="hljs-string">&#x27;host 192.168.1.123 and icmp &#x27;</span> -w <span class="hljs-regexp">/tmp/</span>xxx.cap<br></code></pre></td></tr></table></figure>
<h3 id="抓取helios-与-hot-或者与-ace-之间通信的数据包"><a href="#抓取helios-与-hot-或者与-ace-之间通信的数据包" class="headerlink" title="抓取helios 与 hot 或者与 ace 之间通信的数据包"></a>抓取helios 与 hot 或者与 ace 之间通信的数据包</h3><figure class="highlight nginx"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs nginx"><span class="hljs-attribute">tcpdump</span> <span class="hljs-string">&#x27;host helios and (hot or ace)&#x27;</span><br></code></pre></td></tr></table></figure>
<h3 id="抓取主机210-27-48-1-和主机210-27-48-2-或210-27-48-3的通信"><a href="#抓取主机210-27-48-1-和主机210-27-48-2-或210-27-48-3的通信" class="headerlink" title="抓取主机210.27.48.1 和主机210.27.48.2 或210.27.48.3的通信"></a>抓取主机210.27.48.1 和主机210.27.48.2 或210.27.48.3的通信</h3><figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">tcpdump</span> &#x27;host <span class="hljs-number">210.27.48.1</span> and (<span class="hljs-number">210.27.48.2</span> or <span class="hljs-number">210.27.48.3</span> )&#x27;<br></code></pre></td></tr></table></figure>
<h3 id="抓取ace与任何其他主机之间通信的IP-数据包-但不包括与helios之间的数据包"><a href="#抓取ace与任何其他主机之间通信的IP-数据包-但不包括与helios之间的数据包" class="headerlink" title="抓取ace与任何其他主机之间通信的IP 数据包, 但不包括与helios之间的数据包."></a>抓取ace与任何其他主机之间通信的IP 数据包, 但不包括与helios之间的数据包.</h3><figure class="highlight nginx"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs nginx"><span class="hljs-attribute">tcpdump</span> <span class="hljs-string">&#x27;ip host ace and not helios&#x27;</span><br></code></pre></td></tr></table></figure>
<h2 id="抓取主机210-27-48-1除了和主机210-27-48-2之外所有主机通信的ip包，使用命令："><a href="#抓取主机210-27-48-1除了和主机210-27-48-2之外所有主机通信的ip包，使用命令：" class="headerlink" title="抓取主机210.27.48.1除了和主机210.27.48.2之外所有主机通信的ip包，使用命令："></a>抓取主机210.27.48.1除了和主机210.27.48.2之外所有主机通信的ip包，使用命令：</h2><figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">tcpdump</span> &#x27;ip host <span class="hljs-number">210.27.48.1</span> and ! <span class="hljs-number">210.27.48.2</span>&#x27;<br></code></pre></td></tr></table></figure>
<h3 id="获取使用ftp端口和ftp数据端口的网络包"><a href="#获取使用ftp端口和ftp数据端口的网络包" class="headerlink" title="获取使用ftp端口和ftp数据端口的网络包"></a>获取使用ftp端口和ftp数据端口的网络包</h3><figure class="highlight haskell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs haskell"><span class="hljs-title">tcpdump</span> &#x27;port ftp or ftp-<span class="hljs-class"><span class="hljs-keyword">data</span>&#x27;</span><br></code></pre></td></tr></table></figure>
<p><code>/etc/services</code>存储着所有知名服务和传输层端口的对应关系。这个对应关系是由IANA组织来全权负责管理，<a target="_blank" rel="noopener" href="http://www.iana.org/assignments/port-numbers">http://www.iana.org/assignments/port-numbers</a> 通过Web方式查到。</p>
<h3 id="抓取网卡上特定端口上的http数据包"><a href="#抓取网卡上特定端口上的http数据包" class="headerlink" title="抓取网卡上特定端口上的http数据包"></a>抓取网卡上特定端口上的http数据包</h3><figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">tcpdump</span> -i &lt;interface&gt; port &lt;port&gt; and tcp and &#x27;tcp[((tcp[<span class="hljs-number">12</span>:<span class="hljs-number">1</span>] &amp; <span class="hljs-number">0</span>xf<span class="hljs-number">0</span>) &gt;&gt; <span class="hljs-number">2</span>):<span class="hljs-number">4</span>] = <span class="hljs-number">0</span>x<span class="hljs-number">47455420</span>&#x27; -s <span class="hljs-number">0</span> -A -w &lt;output_file.pcap&gt;<br><br><span class="hljs-attribute">tcpdump</span> -i any port <span class="hljs-number">80</span> and tcp and &#x27;tcp[((tcp[<span class="hljs-number">12</span>:<span class="hljs-number">1</span>] &amp; <span class="hljs-number">0</span>xf<span class="hljs-number">0</span>) &gt;&gt; <span class="hljs-number">2</span>):<span class="hljs-number">4</span>] = <span class="hljs-number">0</span>x<span class="hljs-number">47455420</span>&#x27; -s <span class="hljs-number">0</span> -A -w output.pcap<br><br></code></pre></td></tr></table></figure>
<p>‘tcp[((tcp[12:1] &amp; 0xf0) &gt;&gt; 2):4] = 0x47455420’ 是一个 BPF 过滤器，用于匹配 HTTP 数据包。<br>0x47455420 是 ‘GET ‘ 的十六进制表示。该过滤器将匹配所有包含以 ‘GET’ 开头的 HTTP 请求的数据包</p>
<h3 id="获取roclinux-cn和baidu-com之间建立TCP三次握手中第一个网络包，即带有SYN标记位的网络包，另外，目的主机不能是-xx-com"><a href="#获取roclinux-cn和baidu-com之间建立TCP三次握手中第一个网络包，即带有SYN标记位的网络包，另外，目的主机不能是-xx-com" class="headerlink" title="获取roclinux.cn和baidu.com之间建立TCP三次握手中第一个网络包，即带有SYN标记位的网络包，另外，目的主机不能是 xx.com"></a>获取roclinux.cn和baidu.com之间建立TCP三次握手中第一个网络包，即带有SYN标记位的网络包，另外，目的主机不能是 xx.com</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs s">tcpdump &#x27;tcp[tcpflags] &amp; tcp-syn != 0 and not dst host xx.com&#x27;<br></code></pre></td></tr></table></figure>

<h3 id="打印IP包长超过576字节的网络包"><a href="#打印IP包长超过576字节的网络包" class="headerlink" title="打印IP包长超过576字节的网络包"></a>打印IP包长超过576字节的网络包</h3><figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">tcpdump</span> &#x27;ip[<span class="hljs-number">2</span>:<span class="hljs-number">2</span>] &lt; <span class="hljs-number">576</span>&#x27;<br></code></pre></td></tr></table></figure>
<h3 id="打印广播包或多播包，同时数据链路层不是通过以太网媒介进行的。"><a href="#打印广播包或多播包，同时数据链路层不是通过以太网媒介进行的。" class="headerlink" title="打印广播包或多播包，同时数据链路层不是通过以太网媒介进行的。"></a>打印广播包或多播包，同时数据链路层不是通过以太网媒介进行的。</h3><figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">tcpdump</span> &#x27;ether[<span class="hljs-number">0</span>] &amp; <span class="hljs-number">1</span> = <span class="hljs-number">0</span> and ip[<span class="hljs-number">16</span>] &lt;= <span class="hljs-number">224</span>&#x27;<br></code></pre></td></tr></table></figure>

<h2 id="回放"><a href="#回放" class="headerlink" title="回放"></a>回放</h2><figure class="highlight go"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs go">tcpdump -r xxx.<span class="hljs-built_in">cap</span><br></code></pre></td></tr></table></figure>

<h1 id="异常处理"><a href="#异常处理" class="headerlink" title="异常处理"></a>异常处理</h1><h2 id="使用-i-any-抓取所有网卡数据包时有下图中的-Frame-length-is-less-than-captured-length-错误"><a href="#使用-i-any-抓取所有网卡数据包时有下图中的-Frame-length-is-less-than-captured-length-错误" class="headerlink" title="使用-i any 抓取所有网卡数据包时有下图中的 Frame length is less than captured length 错误"></a>使用-i any 抓取所有网卡数据包时有下图中的 Frame length is less than captured length 错误</h2><img src="/2022/11/10/04DevOps/21tcpdump%E5%AE%9E%E7%94%A8%E6%96%B9%E6%B3%95%E6%80%BB%E7%BB%93/err_01.png" srcset="/img/loading.gif" lazyload class="">

<p>因为tcpdump抓包时，如果-i选项指定为一个网卡地址，那么抓取的数据包数据链路层是以太网头部；如果指定any，则以太网头部将被替换为linux cooked capture头部，见上图。</p>
<p>tcpdump抓包时可以通过 -y 选项来指定data link type，不过测试发现 -i 选项指定 any 时，不支持抓获的包的data link type 为以太网 :</p>
<figure class="highlight coffeescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs coffeescript">[root@whb~]<span class="hljs-comment">#  tcpdump -i any -w test.pcap -y EN10MB</span><br>tcpdump: EN10MB <span class="hljs-keyword">is</span> <span class="hljs-keyword">not</span> one <span class="hljs-keyword">of</span> the DLTs supported <span class="hljs-keyword">by</span> <span class="hljs-built_in">this</span> device<br>[root@whb~]<span class="hljs-comment"># tcpdump -i eth1 -w test.pcap -y EN10MB</span><br>tcpdump: data link type EN10MB<br>tcpdump: WARNING: eth1: <span class="hljs-literal">no</span> IPv4 address assigned<br>tcpdump: listening <span class="hljs-literal">on</span> eth1, link-type EN10MB (Ethernet), capture size <span class="hljs-number">65535</span> bytes<br></code></pre></td></tr></table></figure>

<p>出现这个错误也将导致tcprewrite等改包工具失效，因为包的格式有错误。需要转换<br>转换方式待确定</p>
<h1 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h1><p><a target="_blank" rel="noopener" href="https://www.cnblogs.com/aios/p/9545378.html">https://www.cnblogs.com/aios/p/9545378.html</a></p>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/devops/">devops</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/linux/">linux</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2022/11/10/04DevOps/100%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98%E5%8F%8A%E5%A4%84%E7%90%86/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">常见问题处理方法</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2022/10/21/04DevOps/20lex%E4%BD%BF%E7%94%A8/">
                        <span class="hidden-mobile">lex使用</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  

  

  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  






  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
        typing(title);
      
    })(window, document);
  </script>















<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


</body>
</html>
